Basic auth is not allowed on endpoints that aren't the token endpoint

Right now, if I'm using restify-oauth2 then I can't have basic auth on any of my endpoints because it will respond with a 401 before it gets to my route. In some cases, I would like to loosely secure an endpoint with just basic auth and nothing else or allow basic auth and oauth authorization. 

This change allows for users to implement their own basic auth endpoints if they see fit without compromising the req.username or req.clientId checks.