add access_token to request url when user is authorized