restore secret key in url path as a config setting, support putting the secret key itself in the config file