Basic password protection.

There's one thing I'm a little worried about, and maybe I just did the wrong approach.. I have a test route setup on the example server at / and the plugin authentication ends up affecting that route.

I'd assume a plugins auth settings would only affect that plugins routes, but it doesn't look like thats the case. Ideas?
make sure to add support for css file passing