The page reads GET /secrets/, which is a superuser's, so any other account opened it onto a permission error.