Isn't it considered dangerous to put secrets/passwords as command line args? Just wondering if we should avoid recommending `-Dapplication.secret` in the best practices section, and instead always recommend using something like `-Dconfig.file=production.conf`.