playing with the 'secret_token' and it's secrecy