more on using POST for the token instead of GET