Clarify env.passwords' requirement of full host strings.

Re #1130, closes #1130.