basic password auth works