[wip] default to using basic authentication for secure submissions