Add basic authentication to replication APIs

[erikjohnston]

We descoped adding authentication to the replication APIs (as we could rely on firewalls to protect them), but adding some form of authentication here is good practice.

This could be as simple as just adding a secret to the config and sending it in the authentication header.

[callahad]

@clokep Give this a shot, if it's more than a couple of hours, throw it back to the board.