plugins: basic auth & cors