[Security] Keep other query string parameters when switching users