s3-secrets: only include secrets.h when needed.