allow auth_basic for locations