merge
accept access token as a query param in _oauth register service handler, good for auto-login hack