#44 hide accessToken for client