added note about client secret