if we're not using bcrypt, we need to set the password secret