moved app-secret config