basic auth is better than no auth