Add unset of basic auth header in web app config

Resolves possible issues with Stash 2.1+ and XSRF tokens.
See: https://confluence.atlassian.com/display/STASHKB/XSRF+Security+Token+Missing