fixed secret token stuff