bugfix: validate does not take the secret as argument