This fixes GH-6395 by only appending the access_token once. It also fixes a bug that was never reported. If a user supplied an access_token for a box URL, Vagrant would silently overwrite it. After this commit, Vagrant only appends an access_token to the URL if no value exists at the key.
Vagrant Core Plugins
These are plugins that ship with Vagrant. Vagrant core uses its own plugin system to power a lot of the core pieces that ship with Vagrant. Each plugin will have its own README which explains its specific role.