Authentication is bypassed when accesed via an ipv6 address.

[fakuivan]

Accessing hass-configurator using an ipv6 address literal on the browser bypasses basic authentication. I'm guessing this has something to do with how the username and password are split, as ipv6 literals contain several colons. This is relevant even if you don't have an ipv6 network set up, as link-local addresses are automatically generated for each interface, and can be a point of entry.