@jrochkind unless you can articulate specific examples of how it's not secure, I think we should just use the apps secret token.