customize the nginx role to ensure that all endpoints (including static files) are protected by basic auth if requested (except those that are explicitly exempted.