storing the access_token in the browser sessionStorage