web: fix secret token