fix packages after refactoring, exclude secret from POST request