updated secret file mode requirement (now 0400)