properly store user password and authenticate on user create + auth.http_basic, requires TRANSMIT_CLEAR_PASS=true