functions to get user from access token in api server