--- a/src/luan/host/WebHandler.java	Fri Apr 30 20:23:28 2021 -0600
+++ b/src/luan/host/WebHandler.java	Sat May 01 19:52:56 2021 -0600
@@ -17,6 +17,8 @@
 import goodjava.webserver.handlers.FileHandler;
 import goodjava.webserver.handlers.DirHandler;
 import goodjava.webserver.handlers.HeadersHandler;
+import goodjava.webserver.handlers.BasicAuthHandler;
+import goodjava.webserver.handlers.RegexHandler;
 import luan.Luan;
 import luan.LuanException;
 import luan.LuanTable;
@@ -61,7 +63,20 @@
 			}
 
 			Luan luan = new Luan();
-			initLuan(luan,dirStr,domain);
+			String password;
+			LuanLogger.startThreadLogging(luan);
+			try {
+				LuanFunction fn = Luan.loadClasspath(luan,"luan/host/init.luan");
+				fn.call(luan,dirStr,domain);
+				LuanTable Io = (LuanTable)luan.require("luan:Io.luan");
+				password = (String)Io.get(luan,"password");
+				if( password==null )  throw new NullPointerException();
+			} catch(LuanException e) {
+				throw new LuanRuntimeException(e);
+			} finally {
+				LuanLogger.endThreadLogging();
+			}
+			security(luan,dirStr);
 			LuanHandler luanHandler = new LuanHandler(luan,domain);
 
 			FileHandler fileHandler = new FileHandler(dirStr+"/site/");
@@ -72,6 +87,8 @@
 			Handler notFoundHander = new NotFound(luanHandler);
 			notFoundHander = new ContentTypeHandler(notFoundHander);
 			handler = new ListHandler( handler, dirHandler, notFoundHander );
+			Handler auth = new BasicAuthHandler(handler,"Private","admin",password);
+			handler = new RegexHandler("^/private/",auth,handler);
 			handler = new HeadersHandler(handler);
 			handler = new SafeHandler(handler);
 			handler = new LogHandler(handler,LogHandler.dirLogger(new File(logDir),days30));
@@ -102,19 +119,6 @@
 		return handler.luanHandler.call_rpc(fnName,args);
 	}
 
-	private static void initLuan(Luan luan,String dir,String domain) {
-		LuanLogger.startThreadLogging(luan);
-		try {
-			LuanFunction fn = Luan.loadClasspath(luan,"luan/host/init.luan");
-			fn.call(luan,dir,domain);
-		} catch(LuanException e) {
-			throw new LuanRuntimeException(e);
-		} finally {
-			LuanLogger.endThreadLogging();
-		}
-		security(luan,dir);
-	}
-
 	public static void removeHandler(String domain) {
 		domainHandler.removeHandler(domain);
 	}