remove secret_token