Not sure if token should be part of the URL. Seems like it should be part of the POST body instead.