permit client_iv in secret_params