refactored secret route, error responses