removed APP_SECRET