move bidauth secret out to settings. closes #23