allow local overriding of an http basic password

Adds an optional paramter to our `protected!` method.  This would allow two different sets of HTTP basic creds to be used in the same app.