implementing basicAuth by hand to avoid setting req.user
Merge branch 'hotfix'