calls reject on wrong secret