initdb required! Break out update privileges in RTEs.

Also add ON CONFLICT support.