return tokenSecret if we have it and auth=true