add an access token to a User.