consul connect envoy doesn't respect acl.tokens.default

When filing a bug, please include the following headings if possible. Any example text in this template can be deleted.

#### Overview of the Issue

When I start `consul connect envoy -sidecar-for foo` it gives the error

```
[2020-12-14 21:52:52.313][6173][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:92] StreamAggregatedResources gRPC config stream closed: 7, permission denied
```

If I run the following command `CONSUL_HTTP_TOKEN=abc123 consul connect envoy -sidecar-for foo` it doesn't give this error. In my command abc123 matches the token I am specifying in my agent's `acl.tokens.default` config param.

### Consul info for both Client and Server

Client info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 4
services = 3
build:
prerelease =
revision = 12f574c9
version = 1.8.1
consul:
acl = enabled
known_servers = 5
server = false
runtime:
arch = amd64
cpu_count = 4
goroutines = 80
max_procs = 4
os = linux
version = go1.14.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 9
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1791
members = 7
query_queue = 0
query_time = 1

```

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 12f574c9
version = 1.8.1
consul:
acl = enabled
bootstrap = false
known_datacenters = 3
leader = false
leader_addr = 10.1.52.35:8300
server = true
raft:
applied_index = 183335
commit_index = 183335
fsm_pending = 0
last_contact = 77.691775ms
last_log_index = 183335
last_log_term = 14
last_snapshot_index = 180253
last_snapshot_term = 14
latest_configuration = [{Suffrage:Voter ID:edb9e963-2635-f60e-4b8e-2cf68a45aa42 Address:10.1.52.33:8300} {Suffrage:Voter ID:73350c95-b70d-0948-3fa7-aeaee9f61135 Address:10.1.52.34:8300} {Suffrage:Voter ID:6e5c4d22-3aae-fe6a-b8d4-810a4e182131 Address:10.1.52.35:8300} {Suffrage:Voter ID:7fc1d7eb-267e-1889-ce04-d828fb973f50 Address:10.1.52.36:8300} {Suffrage:Voter ID:899ca7ce-4491-61c0-dae0-76b7fbb2c7f3 Address:10.1.52.32:8300}]
latest_configuration_index = 0
num_peers = 4
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Follower
term = 14
runtime:
arch = amd64
cpu_count = 2
goroutines = 137
max_procs = 2
os = linux
version = go1.14.6
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 9
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1791
members = 7
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 235
members = 15
query_queue = 0
query_time = 1

```

### Operating system and Environment details

CentOS7, pretty vanilla cluster otherwise

### Log Fragments

Include appropriate Client or Server log fragments. If the log is longer than a few dozen lines, please include the URL to the [gist](https://gist.github.com/) of the log instead of posting it in the issue. Use `-log-level=TRACE` on the client and server to capture the maximum log detail.

```
consul@mitrx5n2:TESTING:cjohnson> consul connect envoy -sidecar-for rxaftermath -admin-bind 127.0.0.1:0
[2020-12-14 21:55:26.123][13836][info][main] [external/envoy/source/server/server.cc:256] initializing epoch 0 (hot restart version=disabled)
[2020-12-14 21:55:26.123][13836][info][main] [external/envoy/source/server/server.cc:258] statically linked extensions:
[2020-12-14 21:55:26.123][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.filters.http: envoy.buffer, envoy.cors, envoy.csrf, envoy.ext_authz, envoy.fault, envoy.filters.http.adaptive_concurrency, envoy.filters.http.aws_lambda, envoy.filters.http.aws_request_signing, envoy.filters.http.buffer, envoy.filters.http.cache, envoy.filters.http.cors, envoy.filters.http.csrf, envoy.filters.http.dynamic_forward_proxy, envoy.filters.http.dynamo, envoy.filters.http.ext_authz, envoy.filters.http.fault, envoy.filters.http.grpc_http1_bridge, envoy.filters.http.grpc_http1_reverse_bridge, envoy.filters.http.grpc_json_transcoder, envoy.filters.http.grpc_stats, envoy.filters.http.grpc_web, envoy.filters.http.gzip, envoy.filters.http.header_to_metadata, envoy.filters.http.health_check, envoy.filters.http.ip_tagging, envoy.filters.http.jwt_authn, envoy.filters.http.lua, envoy.filters.http.on_demand, envoy.filters.http.original_src, envoy.filters.http.ratelimit, envoy.filters.http.rbac, envoy.filters.http.router, envoy.filters.http.squash, envoy.filters.http.tap, envoy.grpc_http1_bridge, envoy.grpc_json_transcoder, envoy.grpc_web, envoy.gzip, envoy.health_check, envoy.http_dynamo_filter, envoy.ip_tagging, envoy.lua, envoy.rate_limit, envoy.router, envoy.squash
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.resource_monitors: envoy.resource_monitors.fixed_heap, envoy.resource_monitors.injected_resource
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.resolvers: envoy.ip
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.thrift_proxy.protocols: auto, binary, binary/non-strict, compact, twitter
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.dubbo_proxy.filters: envoy.filters.dubbo.router
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.health_checkers: envoy.health_checkers.redis
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.access_loggers: envoy.access_loggers.file, envoy.access_loggers.http_grpc, envoy.access_loggers.tcp_grpc, envoy.file_access_log, envoy.http_grpc_access_log, envoy.tcp_grpc_access_log
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.transport_sockets.upstream: envoy.transport_sockets.alts, envoy.transport_sockets.raw_buffer, envoy.transport_sockets.tap, envoy.transport_sockets.tls, raw_buffer, tls
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.tracers: envoy.dynamic.ot, envoy.lightstep, envoy.tracers.datadog, envoy.tracers.dynamic_ot, envoy.tracers.lightstep, envoy.tracers.opencensus, envoy.tracers.xray, envoy.tracers.zipkin, envoy.zipkin
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.thrift_proxy.transports: auto, framed, header, unframed
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.clusters: envoy.cluster.eds, envoy.cluster.logical_dns, envoy.cluster.original_dst, envoy.cluster.static, envoy.cluster.strict_dns, envoy.clusters.aggregate, envoy.clusters.dynamic_forward_proxy, envoy.clusters.redis
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.filters.listener: envoy.filters.listener.http_inspector, envoy.filters.listener.original_dst, envoy.filters.listener.original_src, envoy.filters.listener.proxy_protocol, envoy.filters.listener.tls_inspector, envoy.listener.http_inspector, envoy.listener.original_dst, envoy.listener.original_src, envoy.listener.proxy_protocol, envoy.listener.tls_inspector
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.thrift_proxy.filters: envoy.filters.thrift.rate_limit, envoy.filters.thrift.router
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.retry_host_predicates: envoy.retry_host_predicates.omit_canary_hosts, envoy.retry_host_predicates.omit_host_metadata, envoy.retry_host_predicates.previous_hosts
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.udp_listeners: raw_udp_listener
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.dubbo_proxy.route_matchers: default
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.filters.network: envoy.client_ssl_auth, envoy.echo, envoy.ext_authz, envoy.filters.network.client_ssl_auth, envoy.filters.network.direct_response, envoy.filters.network.dubbo_proxy, envoy.filters.network.echo, envoy.filters.network.ext_authz, envoy.filters.network.http_connection_manager, envoy.filters.network.kafka_broker, envoy.filters.network.local_ratelimit, envoy.filters.network.mongo_proxy, envoy.filters.network.mysql_proxy, envoy.filters.network.ratelimit, envoy.filters.network.rbac, envoy.filters.network.redis_proxy, envoy.filters.network.sni_cluster, envoy.filters.network.tcp_proxy, envoy.filters.network.thrift_proxy, envoy.filters.network.zookeeper_proxy, envoy.http_connection_manager, envoy.mongo_proxy, envoy.ratelimit, envoy.redis_proxy, envoy.tcp_proxy
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.dubbo_proxy.serializers: dubbo.hessian2
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.stats_sinks: envoy.dog_statsd, envoy.metrics_service, envoy.stat_sinks.dog_statsd, envoy.stat_sinks.hystrix, envoy.stat_sinks.metrics_service, envoy.stat_sinks.statsd, envoy.statsd
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.dubbo_proxy.protocols: dubbo
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.retry_priorities: envoy.retry_priorities.previous_priorities
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.filters.udp_listener: envoy.filters.udp.dns_filter, envoy.filters.udp_listener.udp_proxy
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.transport_sockets.downstream: envoy.transport_sockets.alts, envoy.transport_sockets.raw_buffer, envoy.transport_sockets.tap, envoy.transport_sockets.tls, raw_buffer, tls
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] envoy.grpc_credentials: envoy.grpc_credentials.aws_iam, envoy.grpc_credentials.default, envoy.grpc_credentials.file_based_metadata
[2020-12-14 21:55:26.124][13836][info][main] [external/envoy/source/server/server.cc:260] http_cache_factory: envoy.extensions.http.cache.simple
[2020-12-14 21:55:26.155][13836][warning][misc] [external/envoy/source/common/protobuf/utility.cc:198] Using deprecated option 'envoy.api.v2.Cluster.hosts' from file cluster.proto. This configuration will be removed from Envoy soon. Please see https://www.envoyproxy.io/docs/envoy/latest/intro/deprecated for details.
[2020-12-14 21:55:26.156][13836][info][main] [external/envoy/source/server/server.cc:341] admin address: 127.0.0.1:0
[2020-12-14 21:55:26.158][13836][info][main] [external/envoy/source/server/server.cc:469] runtime: layers:
- name: static_layer
static_layer:
envoy.deprecated_features:envoy.config.trace.v2.ZipkinConfig.HTTP_JSON_V1: true
envoy.deprecated_features:envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager.Tracing.operation_name: true
envoy.deprecated_features:envoy.api.v2.Cluster.tls_context: true
[2020-12-14 21:55:26.158][13836][info][config] [external/envoy/source/server/configuration_impl.cc:103] loading tracing configuration
[2020-12-14 21:55:26.158][13836][info][config] [external/envoy/source/server/configuration_impl.cc:69] loading 0 static secret(s)
[2020-12-14 21:55:26.158][13836][info][config] [external/envoy/source/server/configuration_impl.cc:75] loading 1 cluster(s)
[2020-12-14 21:55:26.171][13836][info][upstream] [external/envoy/source/common/upstream/cluster_manager_impl.cc:167] cm init: initializing cds
[2020-12-14 21:55:26.175][13836][info][config] [external/envoy/source/server/configuration_impl.cc:79] loading 0 listener(s)
[2020-12-14 21:55:26.175][13836][info][config] [external/envoy/source/server/configuration_impl.cc:129] loading stats sink configuration
[2020-12-14 21:55:26.175][13836][warning][main] [external/envoy/source/server/server.cc:451] there is no configured limit to the number of allowed active connections. Set a limit via the runtime key overload.global_downstream_max_connections
[2020-12-14 21:55:26.175][13836][info][main] [external/envoy/source/server/server.cc:564] starting main dispatch loop
[2020-12-14 21:55:26.222][13836][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:92] StreamAggregatedResources gRPC config stream closed: 7, permission denied
[2020-12-14 21:55:26.335][13836][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:92] StreamAggregatedResources gRPC config stream closed: 7, permission denied
[2020-12-14 21:55:27.020][13836][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:92] StreamAggregatedResources gRPC config stream closed: 7, permission denied
[2020-12-14 21:55:27.829][13836][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:92] StreamAggregatedResources gRPC config stream closed: 7, permission denied
^C[2020-12-14 21:55:27.839][13836][warning][main] [external/envoy/source/server/server.cc:508] caught SIGINT
[2020-12-14 21:55:27.839][13836][info][main] [external/envoy/source/server/server.cc:623] shutting down server instance
[2020-12-14 21:55:27.839][13836][info][main] [external/envoy/source/server/server.cc:570] main dispatch loop exited
[2020-12-14 21:55:27.840][13836][info][main] [external/envoy/source/server/server.cc:616] exiting
```