generate access token and return it