make APIs accept basic auth

probably easiest to read commit by commit

http://manage.dimagi.com/default.asp?139329
Minor point, but this will match an authentication scheme like `"BasicPlus"` (I made that up, it's not a real scheme that I know of). To be more compliant with [the spec](http://www.ietf.org/rfc/rfc2617.txt), we might want to do `auth_header.startswith('basic ')`. Same below for digest.