my take on not exposing secrets

the idea is the default behavior is to not expose secrets.  There are times, though, when it is a handy feature to get the app itself to write out a compete config file.  

this PR adds the ```--admin.expose_secrets``` command line option and adds a ```secret``` attribute to the Options class.  If ```--admin.expose_secrets``` is NOT on the command line, then ```--admin.print_conf```, ```--admin.dump_conf``` & ```--help``` will always an Option's value as "****************" if that Option has the attribute ```secret == True```.

I don't see much of a reason to deprecate the old method.  They can live in parallel with out any trouble, why needlessly break other code.  I suppose we could automatically set ```secret=True``` if the name of the option contains "password"...