basic http auth for production (temp)