accept cors tokens with access_token=