allow both basic auth and session for API