ACL Token as query param