refactored logic for access secret recover into the user service. You can now call a secret_for_access_token to recover one for validation.