OAUth2 Authentication setting always adding the token to url