adding way to switch basic auth on or off via env var