hmm, thankfully sending a custom header seems to work with the secret but wtf