diff --git a/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql b/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql
index 2422f8f..304c060 100644
--- a/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql
+++ b/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql
@@ -19,18 +19,22 @@
 create database visitors;
 use visitors;
 
-# not necessary to create user if we grant (and not supported in some dialects)
-# create user 'brooklyn' identified by 'br00k11n';
 
-grant usage on *.* to 'brooklyn'@'%' identified by 'br00k11n';
-
-# ''@localhost is sometimes set up, overriding brooklyn@'%', so do a second explicit grant
-grant usage on *.* to 'brooklyn'@'localhost' identified by 'br00k11n';
-
+# the below will create user (and note create user not supported in some dialects)
+grant usage on *.* to 'brooklyn'@'%' identified by '${config["creation.script.password"]}';
 grant all privileges on visitors.* to 'brooklyn'@'%';
+# useful if sockets work also
+grant all privileges on visitors.* to 'brooklyn'@'localhost';
+
+# drop the anonymous users eg ''@'localhost' and sometimes other local hostnames
+# (necessary for same-host access as these are more restrictive rules that trump the wildcard above)
+delete from mysql.user where User='';
 
 flush privileges;
 
+
+# and now the table for visitors
+
 CREATE TABLE MESSAGES (
         id BIGINT NOT NULL AUTO_INCREMENT,
         NAME VARCHAR(30) NOT NULL,
diff --git a/qa/src/test/java/org/apache/brooklyn/qa/camp/JavaWebAppsIntegrationTest.java b/qa/src/test/java/org/apache/brooklyn/qa/camp/JavaWebAppsIntegrationTest.java
index e83b244..b3738ac 100644
--- a/qa/src/test/java/org/apache/brooklyn/qa/camp/JavaWebAppsIntegrationTest.java
+++ b/qa/src/test/java/org/apache/brooklyn/qa/camp/JavaWebAppsIntegrationTest.java
@@ -100,7 +100,7 @@
             Assert.assertEquals(app.getDisplayName(), "sample-single-jboss");
                         
             // locations set on AT in this yaml
-            Assert.assertEquals(app.getLocations().size(), 1);
+            Asserts.assertSize(app.getLocations(), 1);
 
             Set<Task<?>> tasks = BrooklynTaskTags.getTasksInEntityContext(brooklynMgmt.getExecutionManager(), app);
             log.info("Waiting on "+tasks.size()+" task(s)");
@@ -147,8 +147,8 @@
             final Entity app = brooklynMgmt.getEntityManager().getEntity(assembly.getId());
             log.info("App - "+app);
             
-            // locations set on individual services here
-            Assert.assertEquals(app.getLocations().size(), 0);
+            // locations set on root node
+            Asserts.assertSize(app.getLocations(), 1);
             
             Iterator<ResolvableLink<PlatformComponent>> pcs = assembly.getPlatformComponents().links().iterator();
             PlatformComponent pc1 = pcs.next().resolve();
@@ -208,8 +208,8 @@
             final Entity app = brooklynMgmt.getEntityManager().getEntity(assembly.getId());
             log.info("App - "+app);
             
-            // locations set on individual services here
-            Assert.assertEquals(app.getLocations().size(), 0);
+            // locations set on root node
+            Asserts.assertSize(app.getLocations(), 1);
             
             Set<Task<?>> tasks = BrooklynTaskTags.getTasksInEntityContext(brooklynMgmt.getExecutionManager(), app);
             log.info("Waiting on "+tasks.size()+" task(s)");
diff --git a/qa/src/test/resources/java-web-app-and-db-with-function.yaml b/qa/src/test/resources/java-web-app-and-db-with-function.yaml
index 5f4f643..08cc6bd 100644
--- a/qa/src/test/resources/java-web-app-and-db-with-function.yaml
+++ b/qa/src/test/resources/java-web-app-and-db-with-function.yaml
@@ -27,9 +27,12 @@
     proxy.http.port: 9210+
     java.sysprops:
       brooklyn.example.db.url: $brooklyn:formatString("jdbc:%s%s?user=%s&password=%s",
-         component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", "br00k11n")
+         component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", 
+         $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password"))
 
 - type: org.apache.brooklyn.entity.database.mysql.MySqlNode
   id: db
   name: My DB
   creationScriptUrl: classpath://visitors-creation-script.sql
+  brooklyn.config:
+    creation.script.password: $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password")
diff --git a/qa/src/test/resources/java-web-app-and-db-with-policy.bom b/qa/src/test/resources/java-web-app-and-db-with-policy.bom
index fa43e70..9841738 100644
--- a/qa/src/test/resources/java-web-app-and-db-with-policy.bom
+++ b/qa/src/test/resources/java-web-app-and-db-with-policy.bom
@@ -36,7 +36,8 @@
           http://repo1.maven.org/maven2/org/apache/brooklyn/example/brooklyn-example-hello-world-sql-webapp/0.9.0/brooklyn-example-hello-world-sql-webapp-0.9.0.war
         java.sysprops: 
           brooklyn.example.db.url: $brooklyn:formatString("jdbc:%s%s?user=%s&password=%s",
-             component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", "br00k11n")
+             component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", 
+             $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password"))
       
         brooklyn.policies:
         - type: org.apache.brooklyn.policy.autoscaling.AutoScalerPolicy
@@ -52,3 +53,5 @@
         name: My DB
         creationScriptUrl:
           https://raw.githubusercontent.com/apache/brooklyn-library/master/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql
+        brooklyn.config:
+          creation.script.password: $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password")
diff --git a/qa/src/test/resources/java-web-app-and-db-with-policy.yaml b/qa/src/test/resources/java-web-app-and-db-with-policy.yaml
index 58d6121..1ea9005 100644
--- a/qa/src/test/resources/java-web-app-and-db-with-policy.yaml
+++ b/qa/src/test/resources/java-web-app-and-db-with-policy.yaml
@@ -26,7 +26,8 @@
   proxy.http.port: 9210+
   java.sysprops: 
     brooklyn.example.db.url: $brooklyn:formatString("jdbc:%s%s?user=%s&password=%s",
-       component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", "br00k11n")
+       component("db").attributeWhenReady("datastore.url"), "visitors", "brooklyn", 
+       $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password"))
 
   brooklyn.policies:
   - type: org.apache.brooklyn.policy.autoscaling.AutoScalerPolicy
@@ -42,4 +43,6 @@
   name: My DB
   creationScriptUrl: classpath://visitors-creation-script.sql
   # or https://raw.githubusercontent.com/apache/brooklyn-library/master/examples/simple-web-cluster/src/main/resources/visitors-creation-script.sql
+  brooklyn.config:
+    creation.script.password: $brooklyn:external("brooklyn-demo-sample", "hidden-brooklyn-password")
     
\ No newline at end of file