use parameter access tokens because header tokens don't currently work