allowing users to auth with accessToken in the url instead of code