ensures that access_token storage is CryptoToken, even if defaults are set otherwise, using CryptoTokenInterface