small bugfix about secret token
better null checking