production does not need basic http auth