The /Sender URI is not protected by KC - it's HTTP_Basic