require basic auth credentials for broker endpoints

return 401 response when credentials are invalid
store the credentials in settings.yml