#33: access token cleanup