added some basic auth (without protecting routes)