defect 37 

basic auth unchecked