auto-redirect to oauth, remove basic auth validation, X-Forward full address not just username