merlin basic auth now works