Fixed a few security issues with params and secret_token.