Lock things down (by IP for now, by user later)