basic auth restriction for download routes