No exact steps to reproduce but I observe the following request while clicking/selecting code in the code view:
GET https://<server>/<user>/<repo>/commit/undefined?undefined&anchor=undefined
Backend will route this request to the git+https router which in turn will ask for basic auth. We should make sure to not send such bogus requests from JS.