fix Ajax call to protected resource via token/HTTPBasicAuth