implements better secret_token scheme... still compromised because of st...

...upidity though