changed secret, redirect works