Better secret_token handling