Add Basic Auth support

This adds basic auth support. Requests to the metrics endpoint will require basic auth if -auth.pass is set.
This seems like a good opportunity to make flag helps strings consistent. Could you make all of them sentence-style (begin with upper-case, end with period?).