How to reproduce:

1. Get a URL for the Widgetize widget in Settings > Widgets > Generic > Metric
2. Go to your account settings and take note ot your token_auth
3. Log out Matomo
4. Paste the widget URL into the URL bar
5. Append your token_auth (i.e. add &token_auth=XXXXX at the end of the URL)
6. Load the page

Outcome: metric widget loads, but sparkline image is broken

Expected: sparklines image not broken

NB: sparkline URL generated by the URL does not contain the token_url, even though widget has it. If you copy and load the sparkline URL as is, you get redirected to the login page. If you add the token_url parameter manually, then the image loads.

Matomo 3.6.0 / PHP 7.2