store access token on front side, bug on cookie, see with @lexoyo