Use a block for setting up UFW: disable if anything fails
I've been locked out of a few machines when start up / enabling fails. We should use a block to make sure that if something goes wrong on this play that UFW is definitely turned off.
I suppose this is also related to #2.