Seems simpler/more reliable to just embed it in the url (more specifically, we're running this via Apollo Server)