make basic auth default true, unless configured to basic=false