You can use Jetty or Tomcat as the embedded web server to run hawtio standalone. Then you can use their security out of the box. And its just like securing any other WAR web application, eg setup their realm, and setup web.xml stuff.
For example this is done in the Apache ActiveMQ distribution which has an embedded Jetty server for the web consoles and WebSocket support.