exclude certain URIs from Basic Auth