Use only token capabilities when a token is provided