auth.rb: Allow ${sec.data.xxx} passwords