clean up secret token