Played with Apache and mod_proxy in front of basicui.
This seems to work, Apache prompts for user:pass. But I had to turn on Basic Auth in API Security (else I got SSE subscription failed).
Has Basic Auth in API implications?
<Location /basicui> AuthUserFile /usr/local/etc/apache24/passwd AuthGroupFile /dev/null AuthName "OH Auth" AuthType Basic require valid-user ProxyPass "http://localhost:4080/basicui" ProxyPassReverse "http://localhost:4080/basicui" </Location>
Repeat Location for /rest and /icon (icon without security)