Add access limiting

**DO NOT MERGE YET** - FEEDBACK AND REVIEW

Worth a look-over in general but specifically a decision should be made on whether we use the vhostname or some HTTP header to indicate the private instance.

Also, how do we go about testing this system?  Do we have a preview environment for it?