don't log access token