minor but important fixes

fix infinite loop in clustered-wordpress-app;
add support for specifying a password (so you can actually log in);
lower policy threshhold to 25 as 100 can be hard to test (or need a lot of threads);
and switch to logback.

only other thing this needs is an App (as opposed to builder) and some @CatalogConfig exposed (or else a mechanism on builders by which @CatalogConfig can be exposed).