remove basic auth from location /