moving secrets to YML per 4.1 (yay!)