more spec fixings-- undoing the access token code mostly