API Secrets: Where the Bearer Model Breaks Down