code: func (a BasicAuth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
  	var protected, isAuthenticated bool
  
  	for _, rule := range a.Rules {
  		for _, res := range rule.Resources {
  			if !httpserver.Path(r.URL.Path).Matches(res) {
  				continue
  			}
  
  			// path matches; this endpoint is protected
  			protected = true
  
  			// parse auth header
  			username, password, ok := r.BasicAuth()
  
  			// check credentials
  			if !ok ||
  				username != rule.Username ||
  				!rule.Password(password) {
  				continue
  			}
  
  			// by this point, authentication was successful
  			isAuthenticated = true
  
  			// remove credentials from request to avoid leaking upstream
  			r.Header.Del("Authorization")
  		}
  	}
  
  	if protected && !isAuthenticated {
  		// browsers show a message that says something like:
  		// "The website says: <realm>"
  		// which is kinda dumb, but whatever.
  		w.Header().Set("WWW-Authenticate", "Basic realm=\"Restricted\"")
  		return http.StatusUnauthorized, nil
  	}
  
  	// Pass-through when no paths match
  	return a.Next.ServeHTTP(w, r)
  }
docs: // ServeHTTP implements the httpserver.Handler interface.