big cleanup, fix basic auth