credentials: make root of creds non-enumerable

+ Refined conditions for detection of successful
  emailing vs failure.
+ New format for secret.js