check access token, session method implemented