rename auth to authprovider
move handlers into webapp package
make use of basic auth