fix basic auth

First change is obvious.

Second change: if basic auth was set, it's anyway gets overwritten by `r.Headers` (which by default is empty map, so it will be overwritten in any case).