added _escaped_fragment_ instead of user auth check for those that support it