Turn off basic auth for all endpoints below '/api'.

Both basic auth and OAUTH2 use the same authorization header so a client can't auth both ways.
Merge pull request #1750 from edx/feanil/nginx_oauth

Turn off basic auth for all endpoints below '/api'.