add heatmap, password-protected, to /derby
take password off everything but /derby