ensures access token is set in response