Added logic to read access token from query string if not present on AuthZ header