"use strict";

var mongoose = require('mongoose');
var async = require('async');
var restify = require('restify');

var AccessToken = mongoose.model('AccessToken');

module.exports = function auth(req, res, next) {
  if(!req.authorization && req.authorization.scheme !== "Bearer") {
    return next(new restify.ForbiddenError());
  }
  async.waterfall([
    function fetchToken(cb) {
      AccessToken.findOne({ token: req.authorization.credentials }, cb);
    },
    function registerToken(token, cb) {
      if(!token) {
        return cb(new restify.ForbiddenError("Token does not match any registered account, please authenticate your account before."));
      }
      req.accessToken = token;
      cb();
    }
  ], next);
};

@@ -210,19 +210,67 @@
 xt) %7B%0A  
-if(
+var token = req.query.access_token;%0A  if(!token && 
 !req.aut
@@ -371,16 +371,70 @@
 ror());%0A
+  %7D else %7B%0A    token = req.authorization.credentials;%0A
   %7D%0A  as
@@ -518,37 +518,13 @@
 en: 
-req.authorization.credentials
+token
  %7D, 

Support access_token query parameter