expose the access token to get around Authorize() not working