more work on secret token authentication