moved the userSecret into another document which potentially fixes #1