Secret token as alternate authentication mechanism