combining js and py script descriptors into one
Added default users.properties and services.properties.

- users.properties contains a password placeholder
- services.properties contains rule to lock down wfst, fixes #39