added by-user access token generation