updated to put auth process into private. validate lack of auth and skip basicAuth accordingly. untested!!