>we gated the hgweb behind a password check (with publicly known conditions to allow access), though since earlier this year we switched to anubis.

I'm wondering why you changed that.
To me anubis seems to be a worse solution, because it's much more complex and it does prevent some legitimate uses like users using simple scripts to fetch things.
For example anubis breaks RSS feeds that are provided by repository web interfaces. I had subscribed to some Arch git RSS feeds to monitor things, but that broke when they switched to anubis. With http basic auth this would be trivial to fix on my side in the RSS reader. With anubis I'm not so sure what to do.