how to handle basic auth