Obtain user_metadata from access_token: Not using rules

From my understanding /tokeninfo is being deprecated, which means it is not safe to use.