this kind of sucks. http basic auth is a good way to keep sites from being public while demoing.