secret-value: allow empty strings