api#users, update access_token if user