make APIs accept basic auth

probably easiest to read commit by commit

http://manage.dimagi.com/default.asp?139329
Looks like `wrappers` defaults to `None`, which is not iterable. Suggested change:
```py
if wrappers:
    for wrapper in wrappers:
        ...
```