#515 basic auth opt-in and disable on http.

Resolves #515