how about a whitelist of valid secret keys... one for each user?