pulling token from URL