For http basic auth, you may as well just "secure" the resource by hosting it at http://my-username-and-password.example.com or http://example.com/username/password/resource
Yes absolutely https.
