basic auth for everything except root