security fix

secret_token removed

docs updated