return insufficient credentials if basic auth header is malformed Fixes #3280
Check access for multiple roles should go through all roles.
