Private frontend auth

Add a check that `private-frontend` is protected by HTTP basic auth.