When BASIC_AUTH defined, require valid-user for /app