only merge bearer auth token if access_token is not nil