Fix: check access token before request