simplify auth design, follow Spring security design, support Basic for
api auth.