Add http_basic_auth to features controller

[hubert]

This would restrict access to only users who know the username and password. Presumably we could add other auth strategies but this seems the bare minimum.