making protected throw on access with an invalid secret