added access control for access_token