Drupal Association members fund grants that make connections all over the world.
I'm using the [submission:values:foo:nolabel] token on a confirmation page, and found that the value only gets passed if "Access all webform results" permission is granted to anonymous users (it displays fine for admin). The value is included with the actual submission with no trouble.
I may be thinking of it wrong, but it seems as though this should only require permission to access one's own submission? Hopefully I'm not missing anything obvious.