basic session auth and tls enabled