urlencoding the secret