protect registration with client basic auth