Adding (Master)Secret reset code to RESTful API endpoints