make APIs accept basic auth

probably easiest to read commit by commit

http://manage.dimagi.com/default.asp?139329
another good point. i just made it a required param instead.