if you were checking for a user for the accesstoken (or vice versa), you can walk through