use basic auth for HWR