same default secret for client and server