adding token_access behavior via params, soon changing to headers