fix(http.auth): use basic auth in every case
test(http.auth): test basic url auth

* untest unsafe basic auth