fix(accounts): only fetch access token if verified