replacing secret token with random hex string