Add (optional) authentication

For those of us who don't necessarily want all our photos to be public, this adds very basic HTTP authentication.

It's enabled by setting AUTH_USERNAME and AUTH_PASSWORD environment variables. If either is left off, no authentication will be used.