fix secret-token