use http username & password to protect couchdb, which should be fine since nobody knows where the db server locates..