add APPUSER (can sudo) and restrict direct ROOT login