allow setting of access_tokens for client device sessions