Do not limit-to-path in the basic-auth module - use path-filter for that