only show login message if access token isn't found