whitelist AccessTokens to be passed

There is one use case needed for some reason 

-Client would like to have a way to have a fixed-account access_token to access backend REST-API ( populate  data entity). 
-Client do not use facebook|google provider at all