removed basic auth in web.go