added POST handling to the basic-authed web server
updated log output
added demo webserver for testing invasion injection and callbacks