Handle initially missing secrets

Avoid calling mask when secret value is None (i.e., doesn't exist yet) and is "sensitive". Only call mask on sensitive value when there is an existing value to mask.