tokenauth_url_outbound_alter doesn't prepend ampersand to token param if query string is not empty

In the case when $options['query'] is passed as a string to url(), tokenauth_url_outbound_alter() should check to see if the string is empty. If not it should prepend 'token=' with an ampersand to avoid urls like:

node/1?foo=bartoken=xxxx

Thanks for the awesome module...!