db and password args made keyword-only (fixes #26)