// one secret, one open, then gone
the secret is revealed once, to the first allowed visitor — save the delete token, it won't be shown again