make handling of instances.xml more robust

instances.xml is currently handled like any other resource. Which means that it is easy to accidentally include tokens for remote instances in pull-request, and that remote configs don't persist through updates. 
It would be both more convenient and secure if the file would be handled slightly differently. But i m not yet sure how to go about it: move it to /db/system/monex? 