Fix for creating secret proof for non-static access tokens.

Wrong secret_proof was being generated when an access token is specified in the URL.