fixed security hole - never share your API secret keys on the client side!