you should document that in case of timeout, a null access token is returned (and its up to the client of this interface to try again)