finish authorization

Use basic authentication for now, may use OAuth later