move upload token into url query