use flask to proxy the access token