add access_token to Session#user