Range-diff !483

back to !483 token: expiring credentials cannot mint; record creator; default read