fix a bug where access tokens are passed around in URLS (when deleting access tokens); snarky-but-true notes inre OAuth2