authorization basic header is now necessary for POST and DELETE to /auth/user