add global $access_token
use global $access_token, guard against CSS attack
remove offline_access permission - it is deprecated
support page access tokens:
- fetch page access token on subscribe / edit
- extend database columns (tokens do not have max length by definition)
use simpler method to get page access token