add express basic auth