fix basic enforced in dev mode

app/rest/auth/auth.go

@@ -37,17 +37,17 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 	f := func(h http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
 
+			if a.basicDevUser(w, r, reqAuth) { // fail-back to dev user if enabled
+				user := devUser
+				ctx := r.Context()
+				ctx = context.WithValue(ctx, rest.ContextKey("user"), user)
+				r = r.WithContext(ctx)
+				h.ServeHTTP(w, r)
+				return
+			}
+
 			session, err := a.SessionStore.Get(r, "remark")
 			if err != nil && reqAuth { // in full auth lack of session causes Unauthorized
-				if a.basicDevUser(w, r) { // fail-back to dev user if enabled
-					user := devUser
-					ctx := r.Context()
-					ctx = context.WithValue(ctx, rest.ContextKey("user"), user)
-					r = r.WithContext(ctx)
-					h.ServeHTTP(w, r)
-					return
-				}
-
 				http.Error(w, "Unauthorized", http.StatusUnauthorized)
 				return
 			}
@@ -103,13 +103,15 @@ func (a *Authenticator) AdminOnly(next http.Handler) http.Handler {
 	return http.HandlerFunc(fn)
 }
 
-func (a *Authenticator) basicDevUser(w http.ResponseWriter, r *http.Request) bool {
+func (a *Authenticator) basicDevUser(w http.ResponseWriter, r *http.Request, reqAuth bool) bool {
 
 	if a.DevPasswd == "" || !a.DevEnabled {
 		return false
 	}
 
-	w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+	if reqAuth {
+		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
+	}
 
 	s := strings.SplitN(r.Header.Get("Authorization"), " ", 2)
 	if len(s) != 2 {