allow an access_token parameter to be specified and pass validation