Adding some internal basic auth support

so that there's at least a smidge of security in place when deployed to heroku or whatebbs.