bearer strategy with user secret