Move secrets back to application.yml