add secret code authentication route