Database privileges

- Default database privileges for a locked down appliance with remote workers

No reason to have most of the installations need to modify the default pg_hba (host base access)

- leave certificates in /certs/ directory to simplify installation

Moving certs around seriously complicates installing a postgres server with ssl. (ask if you really care)

- fix permissions for certificates directory

there is a specific selinux tag for ssl certificates. this way `certmonger` can write here, too.