DSA-18: Keep client_secret in separate, untracked file