fixes #8787. However this introduces config/secrets.yml which has already been deployed to some production machines and used to be in gitignore.
So we first need to clean that up and then we can merge this.