ensure access token is specified