s3-passdb: trying to decouple passdb and secrets a little.