Played with Apache and mod_proxy in front of basicui.
This seems to work, Apache prompts for user:pass. But I had to turn on Basic Auth in API Security (else I got SSE subscription failed).
Has Basic Auth in API implications?
http://host/basicui/app?sitemap=myhome
<Location /basicui>
AuthUserFile /usr/local/etc/apache24/passwd
AuthGroupFile /dev/null
AuthName "OH Auth"
AuthType Basic
require valid-user
ProxyPass "http://localhost:4080/basicui"
ProxyPassReverse "http://localhost:4080/basicui"
</Location>
Repeat Location for /rest and /icon (icon without security)