configuration option whether to store access token in a cookie