Madek can be put behind http_basic_auth

which is in general a bad idea; but since requested by some party ....