Conceal staging and review sites behind simple HTTP auth

During the March 17 S9 meeting, we discussed concerns about the potential for our public staging and review sites to confuse visitors who may stumble upon those sites by accident. To address this, we agreed to conceal those sites behind a basic HTTP web authentication prompt.

The goal is to keep out web crawlers and casual visitors while making it as easy as possible for actual and potential contributors to access those sites. To that end, we decided the user/password would be very simple and identical across both review and staging sites.