> The http basic auth built into every popular webserver is another, with none of the above limitations.

The obvious advantage of OP's approach is that one doesn't need to control the server that serves the HTML (e.g., static site served via GitHub pages would be enough)