ignore web deploy settings by default

web deploy settings include unencrypted passwords
fix typo, will squash commits later
Merge pull request #950 from bbodenmiller/patch-1

ignore web deploy settings by default for security, but add a TODO comment