rfc compliant basic auth