add accessTokenFor to principal object