app-base w/ basic auth