auth.rb 0.3: Allow ${sec.data.xxx} passwords