Some secret management belongs in your HTTP proxy