Add Basic Auth support

This adds basic auth support. Requests to the metrics endpoint will require basic auth if -auth.pass is set.
What is the reason `auth.user` is set by default? It's not clear that BasicAuth is only active when a password is set. In order to make it clear that basicauth is inactive by default, I'd vote to leave both defaults empty.