Support secure setting for appuser shell

The appuser gets /bin/bash as a shell, which is currently hard-coded. Change the default to /sbin/nologin and make configurable.