lock down the basic auth endpoints and browsable api endpoint
merge