changes basic middleware to not return 401 on invalid credentials