title: How to block AppEngine's _ah/start and _ah/stop routes from being visible to the outside world
body: <p>I have _ah/start and _ah/stop routes in my 'Flexible' app. I understand the GAE containers will invoke those endpoints when the app comes up, and is going down.</p>
  
  <p>After I've deployed my app, I can hit them myself from the comfort of my couch. <strong>That makes no sense of course, as random strangers cannot be the arbiter of when app instances come up and go down</strong>.  How do I configure AppEngine to block the publication of those two routes to the outside world?  Or is in my job in the implementation of those two routes to check IP addresses or look for a header only GAE can send?</p>