Ostinato, @Egg's Post is spot on.

Forget the Xara-designed site for the moment.
For 1. Can you currently set up a passworded folder or file on your server? If so then you can do the same for the...