render URLs that include the shared secret

Once we've given the secret once, it's annoying to have to type it again