make sshd template slightly more robust
do the same for rc.conf.local
make ansible install from pip instead of source
add SSL certs to first-time-setup
expand "common" role
add role for picoCMS