don't use a fragment, just put the secret in the url
validate the secret column of galleries (format, length, unique, present)
list and show galleries (list requires admin)

use secret in the path for a gallery
link to 'all galleries' in admin nav