auth.rb: Allow ${sec.data.xxx} passwords

This allows auth.rb to function with passwords that are stored with /secure.