Right now, the toolkit's `HttpApi` has an `auth` option, and it does the basic auth stuff itself. Happy to move that onto the resource handler with an ``auth`` command field if people think that is better, but then we should add a ticket to the toolkit. Not sure if it is worth the work though, if `HttpApi` is doing this already.