Add Basic Auth support

This adds basic auth support. Requests to the metrics endpoint will require basic auth if -auth.pass is set.
Seems like everything else is defined *before* main(). Maybe keep it consistent and keep main() last?