support URL param to token, but still restrict to APIs

modules/auth/auth.go

@@ -32,6 +32,7 @@ func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
 	}
 
 	// Check access token.
+	if IsAPIPath(ctx.Req.URL.Path) {
 		tokenSHA := ctx.Query("token")
 		if len(tokenSHA) == 0 {
 			// Well, check with header again.
@@ -59,6 +60,7 @@ func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
 			}
 			return t.UID
 		}
+	}
 
 	uid := sess.Get("uid")
 	if uid == nil {