protect resque-web with built-in basic auth