The loss and curse of basic auth