add support for secrets

The vault password is `sekrit`, and it only has a placeholder in it.  We
will re-key to a shared password before adding real secrets.
Doubled up a word: "an *an* unencrypted".