same host even if using http basic auth