Added the con+ip_localhost/private functions to make logic simpler.
Blocked json_api endpoint from everywhere except localhost.
Updated the HTML/JS files to use the updated dev password (aka password.)
Fixed the portal camelface so calls to 'ad' work again.