The ability to put a password directly in the json config is old and deprecated, and should be removed. Let's simplify PasswordConfig to only support pointing at a separate secret file.