proper security (basic auth) + bypass in all three endpoints