add basic auth to API endpoint