diff --git a/carrier/carrier.go b/carrier/carrier.go
index b1819df2..655f1b61 100644
--- a/carrier/carrier.go
+++ b/carrier/carrier.go
@@ -89,6 +89,7 @@ func createWebsocketStream(originURL string) (*websocket.Conn, error) {
 	if err != nil {
 		return nil, err
 	}
+
 	wsConn, resp, err := websocket.ClientConnect(req, nil)
 	if err != nil && resp != nil && resp.StatusCode > 300 {
 		location, err := resp.Location()
@@ -125,7 +126,14 @@ func buildAccessRequest(originURL string) (*http.Request, error) {
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("cf-access-token", token)
 
-	return req, nil
+	// We need to create a new request as FetchToken will modify req (boo mutable)
+	// as it has to follow redirect on the API and such, so here we init a new one
+	originRequest, err := http.NewRequest(http.MethodGet, originURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	originRequest.Header.Set("cf-access-token", token)
+
+	return originRequest, nil
 }
diff --git a/cmd/cloudflared/access/cmd.go b/cmd/cloudflared/access/cmd.go
index f0222f87..8d2dda6b 100644
--- a/cmd/cloudflared/access/cmd.go
+++ b/cmd/cloudflared/access/cmd.go
@@ -89,14 +89,12 @@ func Commands() []*cli.Command {
 					Usage:       "",
 					ArgsUsage:   "",
 					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
-					Hidden:      true,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
 							Name: "hostname",
 						},
 						&cli.StringFlag{
-							Name:   "url",
-							Hidden: true,
+							Name: "url",
 						},
 					},
 				},
@@ -105,7 +103,6 @@ func Commands() []*cli.Command {
 					Action:      sshConfig,
 					Usage:       "ssh-config",
 					Description: `Prints an example configuration ~/.ssh/config`,
-					Hidden:      true,
 				},
 			},
 		},