moved the access_token to hidden field