does not returen basic auth for XMLHttpRequests