Check basic auth header only for not-logged-in users