allow local overriding of an http basic password

Adds an optional paramter to our `protected!` method.  This would allow two different sets of HTTP basic creds to be used in the same app.  If you pass in an explicit password or list of passwords, we don't check `settings.basic_password`.  Default behavior is preserved.