document access tokens

this fixes #9