add new service providing runtime secret storage locker via closure wrap