There’s no auth on that request, because you’ve scoped auth to only match requests with a path starting with /home/max/files/.
Looking at that twice, it’s the same as your HTML root. Put it there by accident? Just remove that from your basicauth line.