password protect middleman pages - even on s3