Every endpoint needs an administrator: the session token of an administrator
account, or an API key, which always belongs to one and must carry the scope
the method asks for (a key without scopes reaches no admin method). A plugin token is
refused here whatever its scopes (Server API).