with client_id we're acting as app, which can only access public resources
with access_token we're acting on behalf of user, which can access whatever user can