change deprecated usage of access_token in the url to use instead authorization header.