no cookie on basic auth now, authenticate every single time