remove credentials from security access token ... when does one need to access the access code api side?