Allow changing member/keyholder role ids.
Only allow admins to change settings.
Slightly harden secret check.