Personal tokens are enabled by default. There should be a way for site admins to toggle this on or off.