For security, you could move this app behind an nginx proxy and handle auth (to say /admin/) via client SSL certificates. We do this for a number of internal applications that are exposed on the public web.