working on getting nsecbunker to create one-time-use tokens

you'll enter the generated token on a client and have a policy automatically apply to it the permissions the administrator has granted

here, a policy that just allows using DMs, but can't do anything else: