protecting backstage with basic auth