What version are you running?
3.0.1
What's the URL of the page containing the problem?
/account/preferences/#authentication

What steps will reproduce the problem?

create an API Token
click on full-access to change policy to custom
create a custom policy


{
  "resources": {
    "repository": {
      "*": {
        "allow": [
          "POST"
        ]
      }
    },
    "*": {
      "block": [
        "*"
      ]
    }
  }
}


What is the expected output? What do you see instead?
full-access remains selected and the policy has not changed when curl access to API

If set read only policy and change to custom with above policy => curl fail
What operating system are you using? What browser?
I run curl POST command against reviewboard API
Please provide any additional information below.