I would actually suggest triggering the app secret slightly differently -- there are applications out there that have to work with multiple Facebook applications within the context of the same Ruby app. (A good example is social marketing/brand management, the type of platform I was working on when I started Koala.) A global configuration wouldn't work for that situation.

Instead, what do you think of making the secret be the second parameter for the API initializer? That way, you could easily specify the secret to be used for proofing at the time you create the API. This has two additional bonuses -- it's consistent with the way we pass the secret into other Koala classes, and additionally, many applications don't use the Koala setup block (they just instantiate an API object) so this avoids the need to configure Koala somewhere else on application load for those apps.

```ruby
# if secret is passed in, proof all the requests it makes
api = Koala::Facebook::API.new(token, secret)
```