Only require the vault passwd when necessary.

If you supply your own secrets.yml, it doesn't need to be encrypted because
it's .gitignore'd. Only pass --ask-vault-pass if you're using the default,
encrypted `secrets.prod.yml`.