added poor-man's authentication (secret key in url set from config)