fix access_token scoping