only require access_token auth if from JS app