add http basic auth skeleton

add auth.py and add decorators to most functions to use it.
for now, it's a bogus implementation and lets everyone access,
because we don't have a backend yet.