serve files from tornado; simple auth