pub fn check_secret(base_url: String, secret: String) -> Message
Only a 401 stops the user, so a flaky network never strands someone whose packages are already cached.