get token as query string instead of header