if basic auth, unset Authorization to prevent returned 401
Apache too