in case there are any urls that aren't protected by basic auth, add robots.txt denying all.
move basic auth config back into location blocks to prevent over-inheritance from blocking paths that should be open.