Move secret generation to post-config. And generate it only if not
configured
Shrink down the secret size some, as it gets truncated/expanded to
the hash size anyways. In this case, SHA1, so 64 bytes is enough.