file api + http basic auth