diff --git a/bin/contrib/rex_fsq.py b/bin/contrib/rex_fsq.py
index dba3b295b3997a957bff5a0c3a197120dd98095a..6f87911320ed35959340b5699ec338eb0895d127 100755
--- a/bin/contrib/rex_fsq.py
+++ b/bin/contrib/rex_fsq.py
@@ -20,10 +20,12 @@ import api_roundup.stats as ST
 
 
 # labels des versions "précédentes" (histors dans lesquels chercher)
-INFOS = {"vexpl": "15.8", "vdev": "16.4"}
+INFOS = {"vexpl": "16.6", "vdev": "17.1"}
 
 FILENAME = "rex_all_issues.pick"
-CHANGELOG_PATTERN = osp.join(os.environ["HOME"], "dev", "codeaster", "histor", "1[0-9].*")
+CHANGELOG_PATTERN = osp.join(
+    os.environ["HOME"], "dev", "codeaster", "changelog", "histor", "v*", "[0-9].*"
+)
 
 
 def is_fixed(vers, issue):
diff --git a/lib/api_roundup/rex.py b/lib/api_roundup/rex.py
index cabd9bc8480640037483566cad7c3beb169e587a..d7db21444de39d934288088b197c5e4c4a69e3ef 100644
--- a/lib/api_roundup/rex.py
+++ b/lib/api_roundup/rex.py
@@ -5,6 +5,7 @@
 see documentation at http://roundup.sourceforge.net/docs/xmlrpc.html
 """
 
+import base64
 import os
 import random
 import re
@@ -12,7 +13,7 @@ import ssl
 import sys
 import xmlrpc.client
 from contextlib import contextmanager
-from urllib.request import urlopen
+from urllib import request
 
 from aslint.baseutils import force_list
 from aslint.config import ASCFG
@@ -47,12 +48,8 @@ def _get_url(user="readonly", password="", debug=False):
     return url
 
 
-def _get_connection(user=None, password="", write=False, debug=False):
-    """Return a connection to the Roundup server.
-    If user/password are provided they are passed to the connection.
-    If they are not provided an anonymous user is used if write is False.
-    If write is True user/password are read from the configuration
-    ([aster] section in ~/.gitconfig, option rex-write-user/rex-write-password)."""
+def _get_user_pass(user=None, password="", write=False):
+    """Return user/password for requests with defaults and error message."""
     if not user:
         user = os.environ.get("REX_USERNAME", "readonly")
         if write:
@@ -63,6 +60,18 @@ def _get_connection(user=None, password="", write=False, debug=False):
         "Valid REX credentials are required. "
         "Please define REX_USERNAME and REX_PASSWORD environment variables."
     )
+    return user, password
+
+
+def _get_connection(user=None, password="", write=False, debug=False):
+    """Return a connection to the Roundup server.
+
+    If user/password are provided they are passed to the connection.
+    If they are not provided an anonymous user is used if write is False.
+    If write is True user/password are read from the configuration
+    ([aster] section in ~/.gitconfig, option rex-write-user/rex-write-password).
+    """
+    user, password = _get_user_pass(user, password, write)
     url = _get_url(user, password, debug)
     if (sys.version_info.major, sys.version_info.minor) < (3, 5):
         server = xmlrpc.client.ServerProxy(url, allow_none=True)
@@ -414,15 +423,18 @@ def extract_csv(entity):
         columns = ["id", "username", "realname", "organisation", "address", "roles", "loginaster"]
     else:
         raise ValueError("unsupported entity: {0}".format(entity))
-    url = (
-        "{rex_url}/{entity}?@action=export_csv_names" "{columns}" "&:pagesize=50&:startwith=0"
-    ).format(
+    url = ("{rex_url}/{entity}?@action=export_csv_names{columns}&:pagesize=50&:startwith=0").format(
         rex_url=ASCFG.get("rex.url"),
         entity=entity,
         columns="&:columns=" + ",".join(columns) if columns else "",
     )
+    req = request.Request(url)
+    user, password = _get_user_pass()
+    base64string = base64.b64encode(bytes(f"{user}:{password}", "ascii"))
+    req.add_header("Authorization", "Basic {}".format(base64string.decode("utf-8")))
+
     logger.info(_("exporting data as csv..."))
-    req = urlopen(url)
-    content = req.read()
+    resp = request.urlopen(req)
+    content = resp.read()
     logger.debug(_("{:10} bytes downloaded").format(len(content)))
     return str(content, "utf-8")