server: Add option to use access_token header