rest: basic auth: handle unknown username
rest: deprecate bootserver auth without header
Authorization: Bootserver