no basic auth, protect with ip