also support query string access token instead of just Authorization header