Clarify how access tokens are meant to be supplied to the homeserver.