Embedded view can create token

Hi,

I have just installed 5.6 and working well.
I have added a user with readonly rights for my embedded view.

But i can see that the readonly user can create a new token. Should that be right?

Yes, that's correct.

okay.

shouldn't expact that when it's a read-only user.

Thanks

Token is not stored anywhere, so readonly users can generate it.

Seems strange that a guest user (via token) has permission to create new tokens while also being able to set their own expiry date.

I guess my next step is to find out how to revoke tokens, sounds difficult it they're not saved.