BasicAuth for private endpoints

Some endpoints will be called by the OCM agent only and they should be protected with some kind of authentication mechanism.

Initially the simplest thing to do is HTTP basic authentication.