use basic auth to lock the website