The Radiant wiki says that dev mode has no access controls on it, so it advises using Apache's mod_auth or the like to make sure those viewing it are authorized to do so.
However, on a hosted environment like Heroku, that isn't possible. Also, dealing with one other set of login info is a pain, so I wrote this extension to force anyone viewing the dev site to login via the admin console.
Be warned that the cookies for dev mode and normal mode are different, so if you're working on a public computer make sure not to leave yourself logged in accidentally.
Install it like a normal Radiant extension:
cd your_radiant_app
git clone git://github.com/aughr/radiant-dev-login-extension.git vendor/extensions/dev_login