allow multiple, named resources, each with their own access token

for service_to_service_access tokens