Remove secrets.yml

This is only used for cookie signing, which this API doesn't need.