include clientSecret in GetInitialUrlAsync