using status code constants,
only adding project secret to the headers if device secret is null or empty.

(to fit in with the new backend logic.)