app access tokens are only included in API responses if present.
extract associated access token module.

Reduces duplication in User and App models.