Basic auth header injection working