authenticate across different app context with access token