Lock down Heroku with HTTP Auth

gistfile1.rb

# in config/environments/production.rb
if ENV['HTTP_AUTH'].present?
  config.middleware.use '::Rack::Auth::Basic' do |u, p|
    [u, p] == ENV['HTTP_AUTH'].split(',')
  end
end

# Set HTTP_AUTH on staging:
# $ heroku config:set HTTP_AUTH=username,password