You'll need to define relations per direction. As you pointed out, user.hasMany.accessTokens doesn't imply accessToken.belongsTo.user. Both need to be defined explicitly.
For more information, see http://strongloop.com/strongblog/defining-and-mapping-data-relations-with-loopback-connected-models.