Use a query param instead of access token for greater flexibility.