With a default value set to `client`, the `nomad acl token update` command can silently downgrade a management token to client on update if the command does not specify `-type=management` on every update.