don't protect app unless PASSWORD in ENV