always append access token to url when a user is logged in; makes usage simpler to do opt-out rather than opt-in