feat: gated clone-over-http

[bctnry]

• all clone-over-http must use a username & a password.
• registered users have their own "cloning username / password".
• a "guest user" for anonymous cloning which you can turn on/off at any time.

inspiration: #123

(each usage needs to be logged as well)