Don't send the secret key via GET so it doesn't show in the access logs.