use basic auth in request instead of user info