Adding some internal basic auth support

so that there's at least a smidge of security in place when deployed to
heroku or whatebbs.