fix secret token bug