add basic authentication and make it the default for secure submissions

can't be merged until this is sorted out.