working with appsecret_proof now