Add POSTGRES_PASSWORD and USER, with warning on no password

(and I adjusted the quoting there to be consistent and add quoting in `pg_hba.conf` which we need to verify actually works -- the documentation claims it does)