Replace sesson authentication with token passed over query string