Resolves #11033
I did it, but the secret value is still visible via network traffic. Maybe we should remove it from the backend.
