more tests and fixes for secrets endpoint