Make config value init kwargs strict.

Also reduces API size by moving masking to a dedicated Secret type.