document basic auth without shorthand