token is not part of the URL anymore