Cookie auth -> HTTP Basic auth

**Disclaimer** remove auth details from config/repo once we've set up auth
properly