Remove hardwired parameters

Significant changes:
 - XVA url is no longer hardwired, it is the second, optional parameter to the script
 - Password is no longer hardwired, it is the first parameter to the script
 - Also update the launched image - specify it by uuid