Turn off basic auth for all endpoints below '/api'.

Both basic auth and OAUTH2 use the same authorization header so a client can't auth both ways.