diff --git a/frontend/app.jsx b/frontend/app.jsx
index ba905bd..39a7deb 100644
--- a/frontend/app.jsx
+++ b/frontend/app.jsx
@@ -1,5 +1,8 @@
 'use strict';
 
+var secureUrl = location.pathname + location.search.replace(/&token=[^&]+(&?)/, '$1')
+history.pushState('', '', secureUrl);
+
 import moment from 'moment';
 import React from 'react/addons';
 import Router from 'react-router';
diff --git a/frontend/components/App.jsx b/frontend/components/App.jsx
index a94294c..9f43085 100644
--- a/frontend/components/App.jsx
+++ b/frontend/components/App.jsx
@@ -13,9 +13,10 @@ var App = React.createClass({
   mixins: [ State ],
 
   componentWillMount () {
+    var token = document.documentElement.getAttribute('x-token');
     LoginActions.updateCredentials({
       username: this.props.location.query.username,
-      token: this.props.location.query.token
+      token: token
     });
   },