make APIs accept basic auth

probably easiest to read commit by commit

http://manage.dimagi.com/default.asp?139329