Only allow widgetize and token usage for view users #16263

Not really needed this change I guess but might be better to allow authentication using tokens only for users when the used token has only view access. This may be helpful if otherwise a user tries to embed some screens using token_auth.

Should there be any regressions that we can't fix we could undo it again.

build is failing, looks like this has some other side effects

@diosmosis tests should pass now