fix masking for access token response