where to look for access token can now be declared

via the locations property, passed to authenticateApiRequest