use token as query string (params)