support authentication via query parameter.