secret_token allowed
update