Pass the access token to the model.

We don't especially want the model aware of $_SESSION.