but I'm not sure about the auth situation in this case, just focused on the "how do I read URL parameters" part