use HTTP authentication to protect some actions