Previously, if both env vars and appConfig.auth were configured, the
values in conf.yml would take priority. This has now been reversed, since environmental values are more secure. Now BASIC_AUTH_USERNAME, BASIC_AUTH_PASSWORD will take precidence.

Also, added a warning which will show if user attempts to use both
methods (since they will conflict), advising them to delete one.

When basic auth is enabled, all internal endpoints require HTTP basic
auth headers to be sent. Once the user has authenticaed via the UI,
these will be attached automatically. If ENABLE_HTTP_AUTH env var is
unset, then the auth config is basically just a login page rather than
an access control system.