[api] accept missing secret.key file in test environment and use hardcoded "secret"