replace accesstoken with a route and core-ajax