use membership url to check membership

not the oauth_provider url