enable user authentication

a feature that almost nobody will use: require username/password pairs to access search, browse, text, and lexical paths

the default configuration bypasses all of this: every session can do everything

this is only of interest when not serving from 127.0.0.1