add route for determining users with access to a secret