Use SecureRandom instead of Random to generate the app secret

.. and use StringBuilder instead of StringBuffer (no synchronization needed).
very good catch using StringBuilder. The whole thing is threadsafe inside the method - so there is no reason in using StringBuffer...