secrets.get should verify that the request is for a single secret