admin/ section is unprotected about stashboard

[anarcat]

Some more information about authentication and GAE that I could gleam:

https://developers.google.com/appengine/articles/openid
https://developers.google.com/appengine/docs/python/users/#Python_Authentication_options

Summary: it's pretty hard to do this with the local dev server - this thing really is designed to be deployed in google's silos...

[kyleconroy]

@anarcat as you've discovered, Stashboard is meant to be deployed on App Engine (and app engine alone)

[anarcat]

I quickly understood that indeed, and it's a very unfortunate design flaw, in my opinion.

However, even if the primary target is appengine, why not make it possible to deploy it elsewhere by plugging those holes?

[anarcat]

What about the idea of using nginx or apache as a proxy with access controls?

[kyleconroy]

While using nginx or apache would work, the appengine sdk is not meant to serve production traffic.

[anarcat]

yay silos.