change access token type to bearer
add user object to AccessToken as the server indeed returns it