Issue #1764024 by Dave Reid, klausi: Added some access restrictions to the token/tree page callback to ensure they cannot just be viewed without context.
