hosting: small fixes to update-apps script and docs
hosting: never allow a db without explicit password