title: Protecting admin panel with secret HTTP header - is it foolish?
body: <p>I was just thinking of additional protection for my admin panel. I could send some HTTP header, let's call it <code>Mushroom-Token</code> with some long value. When it's not in the request or when it has invalid value, my admin panel would throw 404 all over.</p>
  
  <p>That would be, of course, only additional layer of protection. When this token is valid, user still needs to log in as an admin.</p>
  
  <p>Does this method make any sense? Isn't that an example of security through obscurity? Or maybe it's widely used technique? And, finally, what are some other ideas of additional protection for admin panel?</p>