Install: fix problem with db_password when retrying after failure

The logic to avoid divulgation of db password was flawed, forcing user
to re-enter the password when retrying after a failed install/upgrade.
Install: fix logic to retry a failed install

Instead of having a single form spanning the entire page, we have one
to display input fields for user to submit new or modified data, and one
with hidden fields to retry failed steps.

With this, the retry button now works as expected.
Install: protect admin password

The admin password must be protected in the same way as the db password,
to avoid divulgating it.