settings: do not include a default secret key