Add optional basic authentication

If $BASIC_AUTH_USER and $BASIC_AUTH_PASS are set in the environment,
use Express's basic authentication middleware to test that the user
has credentials to access the app.

Move the /_status route closer to the top of the routes because
we don't want to protect that with basic auth.