add some comments
ask browsers not to store secrets