>You also create a .xsprivileges file otherwise how will System know what is Basic:
This is NOT true. The Basic is the type of authentication not authorization. You only need an .xsprivileges file for authorization definition.
The actual problem is that you need a comma after true. Your .xsacces should be:
{
"exposed":true,
"authentication":[
{
"method":"LogonTicket"
},
{
"method":"Basic"
}
]
}