also set the api-secret header when posting to device status