Consul template not creating tokens based on Vault auth/token role

### Software version
Nomad: v0.7.1
Consul-template: embedded in nomad
Vault: v0.9.5

### Setup
#### deploy_infrastructure_components policy:
```
vault policy read deploy_infrastructure_components
path "secret/*" { capabilities = ["read","create","update"] }
path "consul/*" { capabilities = ["read","create"] }
path "database/*" { capabilities = ["read","create"] }
path "sys/*" { capabilities = ["read","create","update"] }
path "nomad/*" { capabilities = ["read","create"] }
path "auth/*" { capabilities = ["read","create","update"] }
path "auth/token/create" { capabilities = ["read","create","update"] }
path "transit/*" { capabilities = ["read","create","update"] }
```

#### rundeck policy:
```
vault policy read rundeck
path "secret/*" { capabilities = ["read","create"] }
path "auth/*" { capabilities = ["read", "create", "update"] }
path "consul/roles" { capabilities = ["read", "create", "update"] }
path "consul/roles/*" { capabilities = ["read", "create", "update"] }
```

#### rundeck vault role:
```
vault read /auth/token/roles/rundeck
Key Value
--- -----
allowed_policies [rundeck]
disallowed_policies []
explicit_max_ttl 0
name rundeck
orphan false
path_suffix n/a
period 172800
renewable true
```

#### token given to consul-template by nomad:
```
vault token lookup 61dd3026-1e2f-3681-189b-6ff0eb2887a9
Key Value
--- -----
accessor 772a6cbf-72ef-206c-ff5a-a5cdcbd568a3
creation_time 1523372598
creation_ttl 259200
display_name token-7b4aaea7-45c8-9e84-406d-dd89f0fa2ca8-frontend
entity_id n/a
expire_time 2018-04-13T15:03:19.170298558Z
explicit_max_ttl 0
id 61dd3026-1e2f-3681-189b-6ff0eb2887a9
issue_time 2018-04-10T15:03:19.025535066Z
last_renewal 2018-04-10T15:03:19.170298806Z
last_renewal_time 1523372599
meta map[NodeID:e5b642f0-e877-790d-d824-e83f6ebd795a Task:frontend AllocationID:7b4aaea7-45c8-9e84-406d-dd89f0fa2ca8]
num_uses 0
orphan false
path auth/token/create
period 259200
policies [default deploy_infrastructure_components rundeck]
renewable true
ttl 258136
```

#### Role based token generation on vault cli:
```
vault token create -role rundeck
Key Value
--- -----
token f07f3202-0a5a-7f46-afdd-1455b007d826
token_accessor 2ccc9b06-0895-3a11-7286-b2ae22cf4e35
token_duration 48h
token_renewable true
token_policies [default rundeck]
```

#### Lookup rundeck token
```
Key Value
--- -----
accessor 2ccc9b06-0895-3a11-7286-b2ae22cf4e35
creation_time 1523376868
creation_ttl 172800
display_name token
entity_id n/a
expire_time 2018-04-12T16:14:28.887248148Z
explicit_max_ttl 0
id f07f3202-0a5a-7f46-afdd-1455b007d826
issue_time 2018-04-10T16:14:28.887243589Z
meta
num_uses 0
orphan false
path auth/token/create/rundeck
policies [default rundeck]
renewable true
role rundeck
ttl 171964
```

### Template
```
framework.globals.VAULT_TOKEN={{with secret "/auth/token/create" "role_name=rundeck" }}{{.Auth.ClientToken}}{{ end }}
```

### Expected behavior
A token should be created with the default and rundeck policies

### Actual behavior
Token rendered into template includes the deploy_infrastructure_components policy when it should just include the default and rundeck policy. Path indicates the token was not created from the rundeck role.

```
vault token lookup ea1803af-159f-e865-0c83-7ee6d565e9ce
Key Value
--- -----
accessor f67b2c1b-9185-623c-ce65-d28457f3f306
creation_time 1523372601
creation_ttl 604800
display_name token
entity_id n/a
expire_time 2018-04-17T15:03:21.514827703Z
explicit_max_ttl 0
id ea1803af-159f-e865-0c83-7ee6d565e9ce
issue_time 2018-04-10T15:03:21.496399704Z
last_renewal 2018-04-10T15:03:21.514827991Z
last_renewal_time 1523372601
meta
num_uses 0
orphan false
path auth/token/create
policies [default deploy_infrastructure_components rundeck]
renewable true
ttl 603493
```

### Steps to reproduce
1) Create a deploy policy for consul template to use
2) Create a target policy for the token to be rendered with consul template
3) Create a vault auth token role for the target policy
4) Give consul template a deploy token
5) Create a consul template hcl to render a token from the target role
6) Execute the template
7) Generated target token has all of the policies from the deploy token

### Additional info
I have also tried removing the rundeck policy from the deploy token given to consul template by nomad.
In this case the target token rendered into the template will only have the
policies [default, deploy_infrastructure_components] and no rundeck policy. That may be intended as the token generated from the role should be a subset of the policies of the token that it was created with.

```framework.globals.VAULT_TOKEN={{with secret "/auth/token/create/rundeck" }}{{.Auth.ClientToken}}{{ end }}```

fails with Missing: vault.read(auth/token/create/rundeck)

Start by reproducing the template request to Vault at auth/token/create with role_name=rundeck, comparing it with the role-based token output shown in the issue. Done means the rendered token uses the rundeck role and has the expected default and rundeck policies without inheriting the deploy policy.

Written by the indexing model from the issue text.