It should be $client + secret key from config, just dropped this key during back-porting. This key should be generated during installation. I will restore it.