updated secret token mechanism