back out set-access-token header check