You might want to take a look at the webroot authentication method: Using the webroot domain verification method