I might have figured this out. Looks like a new db user is created for each RAPP, the password is the same as the mysql root password, and the permissions require host=localhost.

I kind of hoped that it wasn't the root mysql password...