basic auth: allways execute non auth block