allow query string auth for GET requests.