mark sensitive templates as such

TODO: this doesn't seem to have any effect, still see
the private stuff in the diff when running chef-client
smoketest job is not compatible with windows