When EventSource from browser, it's not possible to pass basic authentication.
Some polyfills such as https://www.npmjs.com/package/event-source-polyfill
allow to pass custom headers, but it seems easier to rely on native EventSource.

We did not really need basic authentication in the first place, because in our
use cases we don't send confidential information over SSE. Also, we can use
hard to guess channel IDs, so basic authentication does not add much.