Note for myself to double check this, I've got a feeling `capabilities` isn't persisted and is only available when submitting the host#new form.. I'd like to check this works if you edit an image-based host without a root password.