Add a `security.basic.authorize-mode` property that can be used to
affect how basic security authorization is applied.

Fixes gh-2462