Admin authentication is done at the cookie level

...Not IP level. There's a page to enter a password,
authentication is validated whenever albums are viewed.
updating gitignore