$accessToken should be protected not public
Check for headers only by default, also allow a token to be passed in