use location.hostname in the token URL call