updating post_sync action

* moving to v2 controller
* adding support for a secret token
* removing http header guessing