use Secret methods to hide password text

I don't have a test environment to verify this, so I'm hoping you have an easy way to test it.

This is an attempt to fix #19.