client now gets the access token