move auth logic out of the views into the helper, add ini setting for option to check pw in production and skip on devel