added client-side basic auth