in case user and pass are submitted via basic auth we consider this being more important than an existing session.

There must be a reason for the client to pass auth along