Add Basic Auth support

This adds basic auth support. Requests to the metrics endpoint will require basic auth if -auth.pass is set.
I have to admit that @grobie's thought also crossed my mind when first reading this default value ("what? is he always enabling it?"). That probably would break the tie in favor of having empty default flags.