add basic auth option

Because I know most people will have this behind some sort of reverse proxy, but it should be very easy to make it at least not publicly available. 
I believe this option should be on by default but I didn't want to change default behavior without at least a discussion.