updated to use mastersecret & appsecret