better basic auth work-around