app_secret is always avaiable