Get token from JSON payload rather than route parameter.

Add todo.