don't trample all over OPTIONS preflight requests if Basic Auth is configured