I always just put it behind an authenticating proxy.