correct url for QR image, should be ?secret instead of &secret