secret token is now really secret