added basic HTTP auth capability, closes #2