small fixes

now superusers are in a .htaccess protected text file