add access_token as sessionId for authorities