add Gemfile
use basic auth if only production