add basic auth to /admin