adding some more acl and password goodness; lots of server stuff