access token validation responds with account id