one-time secret share — POST /create to create, GET /s/<token> to view