auth code and session id to lock down admin to secret holders