Use environment vars for username, password and express session secret
Move auth middleware to method of backend controller
Add dropdown to view post types in backend list
Tidy up auth methods