Allowed disabling of secret via requireSecret config option.

I added this as we're hosting the health-control controller at a protected URL (S2), so requiring secret in the URL is a bit annoying.  Is it helpful, or could i have disabled another way?