fix for accepting access_token that comes in from mobile clients