Put Bazaar behind a password

[Jason Merrill]

I'm wondering what is the easiest way to put bazaar behind a password in such a
way that I can push and pull.  I'd like to serve from a windows XP machine, and
I've been having some trouble getting OpenSSH running on it.  Is there a way to
put the smartserver (bzr serve) behind a password?  Is there a way to serve a
branch with apache in such a way that others can push and pull?

If sftp is the way to go, is there a simpler way to set it up on windows than
using OpenSSH?  All I need it for at this point is bazaar.

Somewhat as an aside, I've been playing around with bzr+ssh a bit, but without
much success.  Is there any documentation for using this protocol?  On an OS X
machine, I've served a branch using bzr serve, and can access it fine with the
bzr: protocol, but when I do bzr+ssh: it just hangs.

Cheers,

Jason Merrill