LOL I can't belie this shit...
If they hired me to make a CMS for them or have consulted me on security issues - this would NEVER be possible.
If you are SELLING something - you need to PROTECT IT!!!
There are only 2 ways to do it right:
1. put .htaccess password on members folder (+brute force protection)
2. putting your content outside public_html/www folder and reaching it using php (or whatever you use)
http://www.awmzone.com/services