refactor authenticated request into shared function

it's a bit funky with the access token though