Change paths for webapp secrets + add env.yml for arbitrary env keys (e.g. New Relic).