proper use of secure string