Secret values in the admin should be obfuscated

[jptissot]

When we input a secret in the admin (google authentication module "API secret key" for example). The value should not be returned to the client when visiting the page a second time. Currently, the secret is decrypted and is passed back to the client in a password field, but the value is available in the browser's dev tools. I think we should instead use a magic string that would tell the server side to leave the previous value untouched if the user saves the form a second time without modifying the value.

[sebastienros]

I think it's a good idea. Using blank values has some problems.