access token can be used instead of auth code