embed oauth token in HEAD