moved settings around for easier security

NEVER build PrivateSettings.java into a jar/package/thing for the client