minor improvement to the SecretProvider which takes a opaque SecurityToken now