add support for secret, server-side only config
fix regex for route generator
cleanup
cleanup