Deprecate the use of access_token in app layer.