Shut-off direct database access

No longer expose port 37017 on machines, as direct mongo access is no longer required.

This is a repeat of PR 449 (effectively a revert of the revert).

https://github.com/juju/juju/pull/449/

This was reverted because restore still used direct state access. Once PR 561 has been merged direct DB access can be shutoff (again).

https://github.com/juju/juju/pull/561/
Interesting, why two asserts?