Umm yeah the ability to make a server private and password protect it is a very basic and rudimentary function. Just not giving out the IP (since once you give it to one person the chain of custody is compromised by default) is NOT a proper way of keeping people out.
In this case I need to start w. a fresh map due to all the beta duping, and trying to set that up online is hard w/ people constantly joining and asking 100 questions about "is it back?" "is it a new map" etc etc etc
You can not set server passwords. An easy way to keep people you don't want out is just using whitelisting. Or you could use hMod to create groups that allow people to build, and default guests not able to do anything.
As Flabaliki said, just make a whitelist and only whitelist yourself. Then nobody will be able to log on to the server while you're prepping it or whatever it is you're doing. Whitelisting acts the same as passwording, except that a password can be given out just the same as an IP can. So whitelisting is better, in that only the people that you want on the server are allowed to log in.