code in common between getJSONResponse and getJSONEnvelope
access token is optional on some calls