pip supports only basic authentication

[MadJlzz]

pip actually supports only Basic Authentication at the moment.

When gopypi is deployed to AppEngine, we need to find a way to authenticate and authorize pip clients.

[MadJlzz]

After digging a bit how Pypi or even Artifactory are working ; I found out that the authentication part is either proxied to an external IP (identity provider) or management by the application locally.

For this first iteration of Pypi, I will not add authorization mechanism in the sense that all users will have access to all packages. For sure, I want to make this part also flexible enough so that I can extend to more complex authentication mechanism.

For now, I'll ask for an API token that is created once and shared across multiple users. I case of compromised token, a new one should be generate and secrets updated.