If I am writing a microservice that requires an access token to perform any operation, am I correct in saying that I would never design that service such that it would accep