code: function tokenQueryRemove(req, res, next) {
    if (req.query && req.query.access_token && !req.app.locals.bypass(req)) {
      // redirect to URL without token
      let stripUrl = '';
      _.forEach(req.query, function(val, key) {
        if ('access_token' !== key) {
          stripUrl = (stripUrl)? `${stripUrl}&${key}=${val}`: `?${key}=${val}`;
        }
      });
      res.redirect(req.path + stripUrl);
    }
    else return next();
  }
docs: removes token from URL query string (will already be in cookie)