simple http auth to keep application private