webserver: require auth on index page