add basic auth to api