use a new (and secret!) application secret

Great call, @iamvery!  Thanks.