fixed access_token scoping