use http basic auth for api access