adding access token to urls