better client config - disable cookies, only basic auth to try