website: Document putting secret in a config file