[bugfix] XQueryURLRewrite does not check basic auth header, but always executes controller as guest.