Normal users can create tokens but they don't have access to any call other than the /api/v1/profile/* routes. Internally, each token has a list of "scopes" (oauth scopes) which indicate what API can be allowed. For normal users, this scope is only the profile scope. For admin users, it includes all the other API calls.