Added BasicAuth on webapi AND the website hooks into the UserRepo. User API does error checking