secure headers
remove default secret