Add note on secret token alternative