Access management without tokens