doesn't this make our secret public? also, lets move this to another controller (`auth`?)