deal with access token