why is the secret part different from `TEST_APP_SECRET` ?