Basic auth or token page to protect endpoints Acceptance: unauthenticated requests denied, settings protected