Make basic_auth a global nginx parameter

Instead of enabling basic auth per role this makes it
an nginx parameter which makes more sense for sandboxes
and probably other servers where we want basic auth turned on