how is the access token passed?