expose Toaster-Notification and CSRF-Token headers
add basic auth