updated secret route to use authenticated method