Move access token controls to UserController.