fix: access token is missing when application is not authorized for user