options page, hide access token everywhere