v2.4.2: HMAC fail-closed, optional GUI Basic Auth