Shouldn't this use the decrypted password instead? i.e. `secondary_password`?