fix missing error message
allow basic auth for manifest validation