refactor authentication for http-json