For the CLI problems, you should still be using STARDOG_JAVA_ARGS to ensure that the sdpass file is seen for ALL CLI commands and not just server start.
As for the GUI, once you've restarted the server and cleared your browser cache, do you see the same issue? I always run the console in incognito mode (when debugging, anyway), as Chrome likes to cache everything.