basic-auth required only when present in config