Don't always send secret with non-auth requests. It's not necessary on unauthenticated requests, only when performing auth transactions and in those cases the user set's client_secret explicitly.