dont send the access_token on querystring since Oauth2 client already sends it through the Authorization header