moved validate_password to application controller
ignoring secrets
added password protection to products
added password protection to reviews