Add POSTGRES_PASSWORD and USER, with warning on no password

Fixes #31
To be consistent, shouldn't this be down in the `else` with `authMethod=trust` ?