htpasswd file only needed when basic auth is specified
window.entities object now contains all entities' settings, not just names