put cid and access_token query params to header field