remove resolved TODO, the update_secret is hashed using django's "sha1" hasher (salted sha1)