first pass at callback, validating a proper access token is returned by the token endpoint