now a password is needed to become an admin

the secret to our very fancy new feature is in the very fancy new
PromotionPassword servlet, where the password is stored as a constant