prefer Digest over Basic authentication if server offers both