1. added .envrc to .gitignore 2. password prompt for app