Lock WSGI downs with basic auth and required SSL by default.  Also allow making a public (no auth required) WSGI app by appending _public to end of app directory name.