Commented out the add_header so secret token is not sent in response 

back to api caller.

3scale Support Forum with issue and resolution: https://support.3scale.net/forum/topics/protecting-access-to-my-api-backend-while-using-nginx-proxy#new_post