Web access controls

:+1: absolutely.  Should that go in this PR or can that be a future pull request?