Plugged security holes--secret token and constantize