moved secret_token around