Fixed visibility of secret token and validation of password