server/middleware/auth.js
function tokenQueryRemove(req, res, next) {
  if (req.query && req.query.access_token && !req.app.locals.bypass(req)) {
    // redirect to URL without token
    let stripUrl = '';
    _.forEach(req.query, function(val, key) {
      if ('access_token' !== key) {
        stripUrl = (stripUrl)? `${stripUrl}&${key}=${val}`: `?${key}=${val}`;
      }
    });
    res.redirect(req.path + stripUrl);
  }
  else return next();
}
function tokenQueryRemove(req, res, next) {
  if (req.query && req.query.access_token && !req.app.locals.bypass(req)) {
    // redirect to URL without token
    let stripUrl = '';
    _.forEach(req.query, function(val, key) {
      if ('access_token' !== key) {
        stripUrl = (stripUrl)? `${stripUrl}&${key}=${val}`: `?${key}=${val}`;
      }
    });
    res.redirect(req.path + stripUrl);
  }
  else return next();
}
removes token from URL query string (will already be in cookie)