update secrets to use initializers and allow per-environment config