check whether basic auth works for private files

Right, so basic_auth works with jsonapi routes because jsonapi module does this:

    $routes->addOptions(['_auth' => $this->providerIds]);

and so basic auth won't work for private files OOTB.

But we could make it do that -- we could add code to the server module which enables basic_auth for files if the module is enabled.