Makes for an odd decoration.
We generally will not have an app_id in the cases where we are creating
a token just in case it's necessary down the line.
If a client already has powers to move clients around, let them also
activate using the right protocols as well.
This is useful to be able to implement SNI or Notifications where the
shell doesn't get full surface activation when interacting with it.
