Token comes from url