move access_token above javascript that looks for it