This adds:

- Path for storing encrypted settings in config
- optional base token generation
- Additional error handling for missing config and keys