trying secret token validation