Remove HOOK_TOKEN in url in /setup. Security leak