Allow access_token to be sent in url query param