Only check for password/username if actually accessing /__status