require basic auth for API
basic login, needs cleanup