Move secrets to application.yml