[oauth] allows accessToken to take optional verifier