Add extra note about protected_attributes
Generate and send secret for the server to send back for authentication