This is much less flexible than .login_required() (because HTTP authentication is less flexible than custom login pages), but easier to use in a simple proof-of-concept.
