remove location sanitization fix (had been misplaced on vhost)
sanitization not really needed atm; probably should use uriescape or similar from stdlib
comment out apparently broken code related to auth_basic_user_file (not required atm)