just added x-vapi-server-secret to both so I can use them consistently but I expect they will find a way to break this too eventually