add in-memory protection for archive password and master key
credential hardening 1 - use CryptProtectMemory when possible
token hardening 2 - scope reduction