you can lock down the user/admin portal so it's only accessible from your local, but not by default. Maybe we should do that...