If an access token exists, then they are really logged in.