Recommend HTTP Basic in auth guidelines

fixes #29