load and store the access token
browser and device redirects