While you feel this is less than ideal, in my opinion it is a deal-breaker.

Consider the use-case: 
1. Create a new client with a user's `access_token`
2. get a page of protected media that they have access to (either their own protected profile's recent media or that of a protected user they follow)
3. use the response's `next` method
4. the request is made with `Instagram.options[:client_id]` or perhaps a default token `Instagram.options[:access_token]` that does not have access to the protected content
5. surprise: 400 response

The client object will need to be passed to the response so it can be used again for the next page. I considered suggesting the parsing of the `next_url` param, but that solution is nearly as clunky since it doesn't accomodate for the client's connection parameters or other options unless they are baked into the `::Instagram.options` singleton (which is a bad pattern in many applications).