Fortigate web-proxy auth rules

Has anybody ever gotten a local user db working with an explicit proxy? on any FortiOS version? I have cfg and policy and it looks good but every time I test it shows needs authentication.

sample of the cfg I've been testing on now 3 different fortigate

homefgt (root) # show authentication rule
config authentication rule
edit "proxy-auth"
set srcaddr "all"
set active-auth-method "Auth-scheme-Negotiate"
next
end

homefgt (root) # show authentication setting
config authentication setting
set active-auth-scheme "Auth-scheme-Negotiate"
end

homefgt (root) # show user group proxy_user
config user group
edit "proxy_user"
set member "kfelix1" "kfelix"
next
end

homefgt (root) # show firewall proxy-policy
config firewall proxy-policy
edit 1
set uuid 0428149c-e925-51ef-1e15-2684e04091ae
set proxy explicit-web
set dstintf "wan1" "wan2"
set srcaddr "all"
set dstaddr "all"
set service "webproxy"
set action accept
set schedule "always"
set logtraffic all
set groups "proxy_user"
next
end

diag wad debug enable auth

show my Basic AUTHORIZATION which decodes correctly but I believe I'm not matching the authrule, I'm using the simplest auth schema also

homefgt (root) # show authentication scheme
config authentication scheme
edit "exproxy"
set method negotiate
next
edit "Auth-scheme-Negotiate"
set method basic
set user-database "local-user-db"
next
end

Any ideals?