swapped out ampersand config for rc and per-user encryption