Huh? Aren't we sending the secret to the user here?