s3:secrets: convert to use dbwrap wrapper functions only