No basic auth on "/" and "/heartbeat"

For external health checks.