Replace access token mechanism by session based authorization
Remove access token injection from URLs