set only the MYSQL_PWD environment variable

this avoids having to use the unreliable $_ENV superglobal

fixes #950