One shared password for the internal team, over plain HTTP on loopback. Interim: per-person accounts, a second factor on anything that moves funds, and TLS are all still to do.