[keycloak-user] access_token always contains JWT