Hartl listing 3.2; secret token