Purpose of the /token/create api ?

[babyangel0307]

HI developers
I'm confusing on the /token/create api.
May i know the purpose of this api?

Since i think it has a security hole on it.
A client user can grant any permission according to the following flow:

1. A client user login itself
2. Access token of client user default has MANAGE_TOKEN permission
3. Client user can call /token/create api with ANY permission or User ID
   In this case, client can create an admin token or ANY permission token