more logic to prevent access token from sticking around in the url