access-token validation basic support, legacy api for old clients