allow direct access token request from internal application