napping doesn't require UnsafeBasicAuth now.