add the auth token into call back URL