we should add better docs about what specific permissions the cloudflare token needs actually, i think there's a way to generate a prefilled link so users don't have to set them manually