nl_tokens: removes token from URL query string ( will already be in cookie )
pl_tokens: function tokenQueryRemove ( req , res , next ) { if ( req . <mask> && req . query . access_token && ! req . app . locals . bypass ( req ) ) { // redirect to URL without token let stripUrl = '' ; _ . forEach ( req . query , function ( val , key ) { if ( 'access_token' !== key ) { stripUrl = ( stripUrl ) ? ` ${ stripUrl } ${ key } ${ val } ` : ` ${ key } ${ val } ` ; } } ) ; res . redirect ( req . path + stripUrl ) ; } else return next ( ) ; }