Respect basic auth header for execution of controller

XQueryURLRewrite always runs controller as guest, thus making it impossible to hide the file or collection from the public. Should respect basic authentication header instead.