put auth token in query param instead of using http basic auth