protect on no secret_token