Send access_token as url query parameter instead of header