fix vcap_services lookup in secrets.js