parameterized client and secret, refactred xhr