Remove client secret from final user request, it should not be here