would be good to move the param validation into a separate private method = ValidateParams(user, accessToken, expires)