code: func (a *accessTokenAuthenticator) Authenticate(_ string, token string, _ string) (*auth.Session, error) {
  	at, err := a.findAccessToken(token)
  	if err != nil {
  		return nil, err
  	}
  
  	if at == nil {
  		return nil, auth.ErrForbidden
  	}
  
  	session := &auth.Session{
  		User:      at.User,
  		ExpiresAt: at.ExpiresAt,
  	}
  
  	return session, nil
  }
docs: // Authenticate authenticates the access token, which should be provided as the
  // password parameter. Username and otp are ignored.