fix the spots where gitlab thinks we're using hard-coded passwords

http_handler.go

@@ -566,7 +566,7 @@ func (h *Handler) chkInternal(handler http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if h.auth != nil {
 			secret, ok := r.Header["X-Feature-Key"]
-			secretString := ""
+			var secretString string
 			if ok {
 				secretString = secret[0]
 			}

internal/clustertests/cluster_test.go

@@ -97,7 +97,7 @@ func TestClusterStuff(t *testing.T) {
 		t.Fatalf("getting client: %v", err)
 	}
 	ctx := context.Background()
-	token := ""
+	var token string
 	// generate auth token and add to context
 	if auth {
 		token = GetAuthToken(t)