basic auth flow and demo endpoints