move db password setup into provision code as this needs to run only once