add save_access_token init option to save the access token in a session cookie