Provide an easy way to restrict access to provided controllers

[dylanz]

Provide an easy way to restrict access to provided controllers

[dylanz]

Indeed. This is an exercise for the reader, as the authentication schemes on the controllers will vary per project. It's usually something a simple before_filter can handle. That said, the admin section could use a little love, as I think it's married to prototype at the moment, which should probably be extracted out to make it a bit more JS agnostic. Thanks!

[davidw]

Maybe they should be 'off by default' as a security measure. And/or mentioned in the install procedure.

[dylanz]

I added a bullet to the disclaimer section in the README, and also a FIXME comment in the controller itself. Hopefully this will be clear enough. Thanks David!