diff --git a/lib/go/camli/auth/auth.go b/lib/go/camli/auth/auth.go
index ee4292dfc..ce006250f 100644
--- a/lib/go/camli/auth/auth.go
+++ b/lib/go/camli/auth/auth.go
@@ -106,7 +106,6 @@ type UserPass struct {
 func (up *UserPass) IsAuthorized(req *http.Request) bool {
 	user, pass, err := basicAuth(req)
 	if err != nil {
-		fmt.Printf("basic auth: %q", err)
 		return false
 	}
 	return user == up.Username && pass == up.Password
@@ -125,7 +124,6 @@ type DevAuth struct {
 func (da *DevAuth) IsAuthorized(req *http.Request) bool {
 	_, pass, err := basicAuth(req)
 	if err != nil {
-		fmt.Printf("basic auth: %q", err)
 		return false
 	}
 	return pass == da.Password
@@ -155,6 +153,18 @@ func SendUnauthorized(conn http.ResponseWriter) {
 	fmt.Fprintf(conn, "<h1>Unauthorized</h1>")
 }
 
+type Handler struct {
+	http.Handler
+}
+
+func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if mode.IsAuthorized(r) {
+		h.Handler.ServeHTTP(w, r)
+	} else {
+		SendUnauthorized(w)
+	}
+}
+
 // requireAuth wraps a function with another function that enforces
 // HTTP Basic Auth.
 func RequireAuth(handler func(conn http.ResponseWriter, req *http.Request)) func(conn http.ResponseWriter, req *http.Request) {