Changed: basic authentication only (anonymous should be ok)