posting from browser supported as long as secret is posted