Good, so the backendSecret is _not_ meant to be used as a verification that a "certified" and not modified app is connecting. Then it seems to be the same as backendId :-)