allow queries without acess_token