moved OAuth2 Bearer token POST to initialize as it only needs to be called once