loosen basic auth rules