We didn't have a login page

You could have just done a simple HTTP login.

I usually leave the authentication to the end, just before first deployment. it's a bit of a distraction.