add app secret for more secure