return null for an access token rather than throw an exception if the user did not log in
Add comment for the auth method