There seems to be no good reason to change group membership when
exchanging tokens, let's try just passing the old one over.

Simplifies the device manager code as we don't have to duplicate the
IP/network matching logic there.