authentication via HTTP basic auth

Passing credentials via url parameters has the nasty side effect that credentials may end up in logs of intermediary systems (e.g. load balancers, reverse proxies).
This pull requests adds support for http basic authentication.