access token flag auth manager