Basic auth returns 401