removing users.js, moving to secrets