stop using basic auth on production, use ssl