Implement basic auth and GCS rendering.

Instead of reading the file contents and writing them into memory, send the `X-AppEngine-BlobKey` header and an empty response. (Yes, this works for GCS files.) The read+write strategy won't work well for large files.

See an example:
https://code.google.com/p/appengine-go/source/browse/appengine/blobstore/blobstore.go#85