access token is now pulled when a user/pass is provided