only allow heroku.com email addresses to authenticate
get that env outta there
stats! http://cl.ly/image/3d3O010A3V0v